registry / @gethookmyapp/cli / 0.14.5
@gethookmyapp/cli@0.14.5
HookMyApp CLI, No BS. Just go live.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiNo install-time execution, credential harvesting, command-output exfiltration, or remote payload chain was confirmed. The automatic post-login user-scope MCP registration warrants a warning under the extension lifecycle policy.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Successful CLI login with the `claude` executable available.
Impact
Adds a persistent authenticated HookMyApp tool endpoint to Claude Code without a separate setup command.
Mechanism
Automatic first-party Claude MCP registration via `claude mcp add-json --scope user`.
AI rationale
No install-time execution, credential harvesting, command-output exfiltration, or remote payload chain was confirmed. The automatic post-login user-scope MCP registration warrants a warning under the extension lifecycle policy.
Evidence
package.jsonbin/hookmyapp.jsdist/cli.js
Network endpoints1
api.hookmyapp.com/mcp
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/cli.js auto-installs a user-scope Claude MCP entry after successful login when `claude` is present.
- The entry points to the HookMyApp MCP endpoint and uses a helper that prints the current bearer token.
Evidence against
- package.json has no install lifecycle hook; only prepublishOnly is declared.
- The MCP setup is first-party, named `hookmyapp`, and also available as an explicit `mcp install --agent claude` command.
- Child-process use is bounded to Claude MCP management and `doctor` version checks; no shell payload execution found.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Oversized source lightweight scan
Source & flagged code
6 flaggeddist/cli.jsView file
48* Constructs the CommanderError class
L49: * @param {number} exitCode suggested exit code which could be used with process.exit
L50: * @param {string} code an id string representing the error
...
L1204: var EventEmitter = __require("node:events").EventEmitter;
L1205: var childProcess4 = __require("node:child_process");
L1206: var path3 = __require("node:path");
...
L1254: this._outputConfiguration = {
L1255: writeOut: (str) => process18.stdout.write(str),
L1256: writeErr: (str) => process18.stderr.write(str),
...
L1296: * @returns {Command[]}
L1297: * @private
L1298: */
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cli.jsView on unpkg · L4848* Constructs the CommanderError class
L49: * @param {number} exitCode suggested exit code which could be used with process.exit
L50: * @param {string} code an id string representing the error
...
L1204: var EventEmitter = __require("node:events").EventEmitter;
L1205: var childProcess4 = __require("node:child_process");
L1206: var path3 = __require("node:path");
...
L1254: this._outputConfiguration = {
L1255: writeOut: (str) => process18.stdout.write(str),
L1256: writeErr: (str) => process18.stderr.write(str),
...
L1296: * @returns {Command[]}
L1297: * @private
L1298: */
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/cli.jsView on unpkg · L48Findings
4 Critical2 High3 Medium5 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalCommand Output Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @gethookmyapp/cli@0.14.5.
See all versions of @gethookmyapp/cli for other recorded verdicts.
- Review the evidence and your use of @gethookmyapp/cli@0.14.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.